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5 December 1975 


REPORT OF AGENCY TASK FORCE REVIEW 
OF GAO AUDIT OPTIONS 


The Agency Task Force of Directorate representatives established 
at the request of the Director to develop recommendations for ground 
rules which should apply to any resumption by GAO of audit of Agency 
activities has reached conclusions which are set forth in the para- 
graphs which follow. 

I. STATEMENT OF THE PROBLEM 

If ’GAO resumes audit of Central Intelligence Agency activities 
what limitations or restrictions should apply? 

II. OFFICIAL POSITIONS 

A. Comptroller General 

It is assumed the Comptroller General favors resumption of GAO 
audit of Agency activities, provided it could have sufficient access 
to produce meaningful evaluations. 

- B. House and Senate Select Committees 

We infer from conversations with staff representatives of the 
Committees and from Congressional questions that the Committees are 
likely to recommend resumption of GAO audit of Agency activities. 

C. Rockefeller Commission 

The Commission Report made no reference to GAO audit, recommending 
instead that the President's Foreign Intelligence Advisory Board assume 
an audit responsibility. 

D. Congress 

At least one bill has been introduced (by Senator Proxmire) 
to formally direct resumption of GAO audit of Agency activities at 
the direction of any of the Oversight Committees. 

;• - E. Director of Central Intelligence \ V-'-' 

The Director is on record as being of the opinion that arrangements 

- can be made for : resumption of GAO audit of Agency activities subject 
to necessary limitations and to agreement on security procedures and 
on distribution and content of reports on audits. 
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III. DISCUSSION OF OPTIONS 

The Task Force in preparing this report gave careful attention 
to (1) the evolution of statutory authority for Confidential Funds, 

(2) the history of GAO audit relationships with the Agency, (3) the 
nature of GAO audits as currently conducted in other agencies and 
(4) the impact on CIA of resumption of GAO audit of Agency activities. 

A. Evolution of Statutory Authority for Confidential Funds 

The capability of carrying out certain operations in the interest 
of the United States Government in an extremely secret fashion is a 
capability that has been continued down through the nation's history. 
President Washington asked for, and got, a secret "contingent fund" 
expenditures from which he could account for "by making a certificate 
of the Amount of such expenditure, as he may think it advisable not 
to specify; and every such certificate shall be deemed a sufficient 
voucher for the sums therein expressed to have been expended." (Stat. 
at Large, I, 299). This fund was used by Washington and successive 
Presidents for their foreign intelligence efforts, and it was well 
understood that the existence of the fund was grounded on the need 
for extreme secrecy in certain matters. This rather special capability 
comes down to us in present times of more complex government in the 
form of statutory authority for the President's Director of Central 
Intelligence to exercise control over the expenditures of confidential 
funds. This is the Director's 8(b) authority the actual terms of which 
closely parallel the authority given President Washington. The 
capability for the Government to fund certain sensitive undertakings 
in a manner consistent with the requirements for strictest secrecy 
has never been lost or abandoned throughout our history. 

B. History of GAO audit relationships 

1. Initial Audits . Following enactment of the Central Intelligence 
Agency Act of 1949, the Director, notwithstanding the very broad and 
unusual powers granted to CIA by the Act, requested site audit of 
certain expenditures consistent with arrangements initiated in August 
1946 with the predecessor Central Intelligence Group. Under those 
arrangements the site audit covered expenditures referred to as 
vouchered funds (those which can be accounted for and audited in 
conformance with the laws that apply to other Government agencies 
and with standard Government regulations and procedures) as distinguished 
from confidential funds (accounted for outside the Agency solely by 
certification of the Director of Central Intelligence under the authority 
of section 10(b) (now 8(b)) of the CIA Act of 1949. ) The audit process 
was essentially limited to a review of fiscal officers ' accounts, :v 

including examination of certain related vouchers and other documents 
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evidencing the expenditure of appropriated funds to determine whether 
the expenditures v/ere made in accordance with the National Security 
Act of 1947, the CIA Act of 1949 except Section 8(b) and with laws 
and regulations generally applicable to Government expenditures. In 
addition, the site audit staff performed liaison functions between 
CIA and the General Accounting Office as requested by CIA officials. _ 
Potentially questionable expenditures were submitted to the site audit 
staff for review prior to payment. Reports were not issued to anyone 
outside CIA, and formal exceptions to the expenditures made were not 
taken but instead any questions were discussed informally with CIA 
officials. 

2. Expansion of Scope. Subsequent to enactment of the Central 
Intelligence Act of 1949 the General Accounting Office broadened the 
type of audit made of the activities of Government agencies generally. 
Under the new "comprehensive" audit approach the General Accounting 
Office construed an agency's financial responsibilities as including 
the expenditures of funds and the utilization of property and personnel 
in the furtherance of authorized programs or activities in an efficient, 
economical and effective manner. In 1959 the General Accounting Office 
asked permission to discontinue audit of CIA, however, the CIA 
Subcommittee of the House of Representatives Committee on Armed Services 
requested that the General Accounting Office actually broaden the scope 
of its audit of CIA activities. This request was made in a letter to 
the Director of CIA from the Honorable Paul J. Kilday, Chairman, 

Special Subcommittee on CIA, Committee on Armed Services , dated 19 June 
1959. Following a series of extensive discussions, the Director 
proposed to the Comptroller General in a letter dated 16 Oct 1959 
certain principles for the expanded audit. The Comptroller General 

in his letter to the Director dated 21 Oct 1959agreed to proceed with 
plans for the expanded audit on a trial basis within the principles 
expressed in the Director's letter. 

3. Discontinuance of Audit. In 1961, after completion of a 
trial period, GAO concluded that under existing security restrictions 
on its audit of CIA activities, it did not have sufficient access to 
make comprehensive reviews on a continuing basis which would produce 
evaluations helpful to the Congress. It further determined that 
continuation of the limited financial audit effort which it had 
conducted in prior years at the CIA would not serve a worthwhile 
purpose; it therefore proposed to discontinue all GAO activities 

at the Agency. At about this same time the Agency was engaged in 
a major reorganization and strengthening of its comptroller and 
internal audit functions. (The Agency Audit Staff reports directly 
• to the Director of Central Intelligence through the Inspector General 
and observes the same audit principles and standards as the GAO.) 
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Based in part upon these developments and in recognition of the validity 
of the need for restrictions on the scope of audit the Honorable Carl 
Vinson, Chairman, Committee on Armed Services, House of Representatives 
agreed in July 1962 to the Comptroller General's recommendation to 
terminate all audit efforts; since that time GAO has not conducted 
any reviews at the CIA nor any reviews which focus specifically on 
CIA activities except for (a) a Congressional ly initiated request for 
GAO review of the Radio Free Europe program from inception through 
30 June 1971 which resulted in issuance by GAO of an unclassified 
report, B-173239, and a classified supplement, both dated 25 May 1972 
and (b) three recent reviews discussed in the next paragraph. 

4. Ad Hoc Reviews . Recently, the Honorable Lucien Nedzi, 

Chairman, Special Subcommittee on Intelligence, requested GAO to 
review the processes followed for the sale of the assets of two of 
our air proprietaries v/hose relationship with the Agency had become 
generally known to the public. Three reviews have been completed 
in this regard" and classified reports commenting favorably on the 
method and propriety of the sales issued directly to Mr. Nedzi. 

C. Current Nature of GAO audits in other agencies. 

1. The objectives of GAO audits are to determine: 

a. Whether the agency is carrying out only those activities 
or programs authorized by the Congress and is conducting them in 
the manner contemplated to accomplish the objectives intended. 

Where appropriate, a review is also made for the purpose of 
considering whether the authorized activities or programs effec- 
tively continue to serve their originally intended purpose. 

b. Whether the programs and activities are conducted and 
expenditures are made in an effective, efficient, and economical 
manner and in compliance with the requirements of applicable 
laws and regulations, including decisions of the Comptroller 
General . 

c. Whether the resources of the agency, including funds, 
property, and personnel, are adequately controlled and utilized 
in an effective, efficient, and economical manner. 

d. Whether all revenues and receipts arising from the 
operations under examination are collected and properly accounted 

- for. - ■ r...;.:.-:/;-';- 

e. Whether the agency's accounting system complies with the 
principles, standards, and related requirements prescribed by 
the Comptroller General. 
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f. Whether reports by the agency to the Congress and the 
central control agencies disclose properly the information required 
for the purposes of the reports. 

2. The usual emphasis of current GAO audits is on the "big 
picture" and typically includes reviews of (a) activities of the 
agency against the backdrop of governing laws and Congressional intent, 

(b) management controls and (c) budgetary and financial control practices. 
Continuing attention is given to possible duplications of effort within 
an agency or with activities of other agencies. 

D. Impact on CIA of Resumption of GAO audit of agency activities. 

1. It seems obvious that unlimited access by GAO to agency activities 
to achieve the general and specific objectives discussed above and 

full public reporting of the results of audits would be unacceptable. 

2. The comments and conclusions which follow take into consideration 
the positions of each of the Directorates based upon careful soundings 

by the respective directorate representatives of the principal components 
in their Directorates for an objective analysis of the potential impact 
of a comprehensive GAO audit on the diverse functions of each such 
component. 

a. Each of the Directorates has expressed a variety of very 
legitimate concerns about a comprehensive and unrestricted GAO 
audit. These concerns all basically relate in a broad sense to 
the need to protect the sensitive intelligence sources and methods 
which the Director by statute must protect from unauthorized 
disclosure. It is also the consensus that it is a basic require- 
ment for the successful conduct of sensitive aspects of the Agency 
mission that the Director's 8(b) authorities be preserved. In 
the future as in the past, it will be necessary to undertake 
actions of extreme sensitivity for which a withholding of information 
from all except those directly involved is essential to the success 
of the action. In the context of these concerns there is general 
agreement in a pragmatic sense that in determining the potential 
scope of audit should GAO nevertheless resume an audit function, 
a clear distinction must be made between: 

(1) activities which would provide information to the 
auditors which if divulged would represent an unauthorized 
disclosure of intelligence sources and methods 

• .-'A . j-jy'V •• versus ;y;’'y/ ' '-"s ir 

(2) activities which would directly compromise the 

Agency mission and thus cannot be allowed, e.g., various 
external verifications or evaluations of transactions or 
activities not openly Agency sponsored. A listing of such 
transactions or activities follows: —y 
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b. There presumably should be no real controversy in reaching 
agreement with GAO upon the types of activities which cannot be 
allowed because they would compromise the Agency mission. Likely 
to be much more difficult will be the denial of access by GAO to 

the following kinds of activities or information involving especially 
sensitive intelligence sources and methods or operations which are 
treated within the Agency on a highly compartmentalized basis: 

(1) Identities of agents, sources and persons and 
organizations involved in operations which, if disclosed, 
could subject them or their families to personal physical 
danger, or to extreme harassments, or to economic or other 
reprisals. 

(2) Designated highly sensitive material provided 
confidentially by cooperating foreign intelligence services 
which if disclosed could eliminate the foreign intelligence 
service as a source of further information. 

(3) Specific details of designated sensitive intelligence 
methods and techniques of collection which if disclosed would 
compromise and terminate the viability of the method or 
technique. 

(4) Designated sensitive operations for which expenditures 
will be certified by the Director under section 8(b) which if 
disclosed could destroy the effectiveness of the operation. 

c. Although GAO in the normal execution of its audit programs 
might not necessarily press for the foregoing categories of 
information, the point is that in the absence of an agreement any 
auditor has a right in a normal audit situation to any information 
he believes to be relevant to his audit mission. Hence the 

of treati rig- ffife principle here involved as an issue ■ ; 

. -• " for open resolution. . • \ • v-a--- ' c'i 1 

d. The Task Force believes it is important to emphasize 
that this proposed audit limitation cannot be monitored simply 
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by denying access to financial vouchers covered by DCI certification 
under section 8(b). Much of such information is not related 
directly to specific disbursements, hence it is important to 
establish the broader principle of denying access not on the basis 
of DCI certification of funds but on the basis of the substance 
of the information. 

e. There is general recognition in relation to all of the 
foregoing the Agency has never been immune to the risk of un- 
authorized disclosure by its own employees either by carelessness 
or by design, particularly on the part of employees who have 
terminated their Agency association. The risk of such leaks is 
of course minimized by a large body of security practices with 
heavy emphasis on compartmentation and the need-to~know principle. 
The missing ingredient in security practices is of course the 
lack of a law (which the Director has requested) which would 
impose penalties against unauthorized disclosures. 

E. Security 

1. Any resumption of GAO audit whether based on a legislative 
directive or on the request of the Director, will necessarily require 
negotiations between the Director and the Comptroller General to 
establish the general parameters for the scope of audit and related 
arrangements. In this context it is believed as a precondition to 
resumption of any GAO audit relationship: 

a. That all GAO personnel to be involved directly or 
indirectly in such audits should be subject to identical security 
arrangements as pertain to Agency personnel, i.e., full security 
clearance(s) , execution of secrecy agreements, and observance 

of the compartmentation principle to the maximum practical extent. 

b. That audit reports should be subject to review and 
sanitization by the Agency to protect sensitive intelligence 
sources and methods. 

c. That classification and distribution of audit reports 
should be subject to Agency review. 

d. That all written materials used or developed in conjunction 
with the audits should be secured in accordance with Agency 
security standards. 

2, It fs believed there shouTd be a direct correlation between 
the forego Trig Security and controT arrangements assuring protection of 
sources and methods and the agreed upon scope of audit; i.e., the 
extensiveness of scope agreed upon should be contingent upon the 
security and control arrangements. ... 

" ' • . 8 • ' fvV TV- '' 
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F. Audit Options 

After full exploration of the range of viable options for 
consideration other than continuation of the present status quo, 
only two are considered viable in the circumstances. Resumption of 
a limited audit of pre-1962 scope is not included because there is 
nothing to suggest such an approach would be more palatable to GAO 
today than when it was discontinued. The two options are as follows: 

1. Systems Audit (Least Impact) 

a. Review of Agency Audit Staff procedures, the Agency 
Accounting System and supporting procedures for Agency financial 
administration. Such a periodic systems audit or review could 
provide Congressional Oversight Committees with an independent 
evaluation and confirmation that generally accepted accounting 
principles and standards are being observed by the Agency in its 
stewardship of public funds and that audits are conducted in 
accordance with Federal Audit Standards. 

b. It is the consensus of the Task Force this type of review 
could be accommodated without undue risk to unauthorized disclosure 
of intelligence sources and methods. As a matter of precedent 

the Agency on its own initiative in 1973 engaged Touche Ross and 
Company to review Agency audit practices. The principal conclusions 
of that review were that (1) the overall internal audit effort is 
adequate to safeguard Agency assets and ensure administrative 
compliance with laws and regulations and (2) Agency management 
should encourage broader audit coverage of the economy, efficiency 
and effectiveness with which its programs are conducted. A 
similar review by GAO would have the advantage of placing the 
Agency in compliance with the GAO requirement upon Federal agencies 
generally for GAO review and approval of Agency accounting systems. 

2. Full Scope Audit in accordance with GAO Standards with 
Limitations. 

a. Full access to internal fiscal and program documentation 
for all CIA activities excluding access to: 

(1) Identities of agents, sources and persons and 
organizations involved in operations which, if disclosed, 
could subject them or their families to personal physical 
danger, or to extreme: ftarassments*. or to economfc or other > 

: ' reprisals. ■- -Tt 1 './■ 

(2) Designated highly sensitive material provided - \ 
confidentially by cooperating foreign intelligence services 
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v/hich if disclosed could eliminate the foreign intelligence 
service as a source of further information. 

(3) Specific details of designated sensitive intelligence 
methods and techniques of collection which if disclosed would 
compromise and terminate the viability of the method or technique. 

(4) Designated sensitive operations for which expenditures 
will be certified by the Director under section 8(b) which 

if disclosed could destroy the effectiveness of the operation. 

b. In addition to denying access to information as described 
above there must also be a prohibition against actions, conventional 
for auditors, in normal circumstances, that would actually compromise 
sensitive activities or programs. More specifically there must be 
restrictions against external pursuit of any audit trail, confirmation 
of any transaction or investigation of attainment of any program 
objective that would reveal auditor/U.S. Government/CIA interest 
directly or indirectly to any individual, instituion, or foreign 
government not witting of CIA association with the matter of concern 
to the auditor; or in the case of witting relationships would 
violate a mutually binding commitment to keep the fact of such 
relationships secret. Similar restrictions are a "way of life" 

to Agency certifying officers and Agency auditors. As representative 
examples, a GAO auditor (Agency auditor or Finance certifying officer) 
could not (a) go into a Swiss bank to confirm receipt by the bank 
of a deposit into a numbered account, (b) review the activities of 
external action parties carrying out a covert action program, or 
(c) interview key persons associated with the target of the covert 
action program to assess the degree to which the program may have 
attained its objectives. A detailed listing of transactions or 
activities which should not be subjected to external review or 
verification is provided beginning on page 5, paragraph I I I. D. 2. a. (2). 

c. It is the consensus of the Task Force that this type of 
review would create a potential risk of unauthorized disclosure 

of intelligence sources and methods which would increase in direct 
proportion to any erosion of the limits on GAO access stipulated 
above. General public knowledge and awareness of an expanded 
scope of audit could also serve as a deterent to the recruitment 
of agents and to the enlistment of support of bankers, attorneys, 
companies, liaison services, etc., so necessary to the accomplish- 
ment of the overall Agency mission. ... ... - . ... . , - 

... ; d. . Under either of the audit options described above - 
circumstances will inevitably arise where there will be. differences 
of view between the GAO and Agency components as to the scope and 
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definition of information to be made available. As a forum for 
establishing and administering guidelines for implementing any 
agreement with the Comptroller General, it is suggested a Senior 
Review Panel comprised of the Associate Deputy Directors and the 
General Counsel be established. Issues not satisfactorily resolved 
by the Panel would necessarily be referred to the Director for 
resolution directly with the Comptroller General. It is suggested 
this Senior Review Panel should also provide a forum for resolving 
any differences of view between Agency components and GAO concerning 
areas in which external verifications are suitable. 

IV. RECOMMENDATIONS 

If GAO review of the Agency is mandated by an Act of Congress, 
or if the Director determines to undertake negotiations with GAO for 
an audit on his own initiative, the GAO Audit Task Force recommends: 

1. That the following principles guide the Director's negotiations: 

a. That GAO personnel and reports must be subject to security 
limitations acceptable to the Agency. These are enumerated on page 
8, paragraph III.E. of this report. 

b. That the Director seek to have a GAO audit limited to a 
Systems Audit, as defined and discussed on page 9, paragraph 
III.F.l . of this report. 

c. That if a "full scope audit" by GAO is instituted, the 
Director exercise his authority under Section 8(b) of the CIA Act 
and his responsibility to protect intelligence sources and methods 
so that: 

(1) GAO would not be permitted external review or verification 
of certain activities (enumerated beginning on page 5, paragraph 
III. D. 2. a. (2)) which would compromise Agency activities, and 

(2) GAO would not be permitted access to internal 
documentation relating to certain extremely sensitive activities 
(categories of information listed beginning on page 9, paragraph 
III. F. 2. a). 

2. That a senior review panel comprised of the Associate Deputy 
Directors and the General Counsel be named to implement and administer 
any arrangement for resumption of GAO audit of Agency activities. 
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